0

How I can to setup the server firewall to deny any ICMP traffic come only from host 1 while permitting the other.

host 1 is a switch Vlan = 192.168.10.2/24

when I do

Remote Ip = 192.168.10.2 Wildecard Mask = 0.0.0.255 the server deny all hosts.

2
  • Yes, that wildcard mask affects 256 addresses. You have eight address bits in the wildcard mask (2^8=256). but you seem to want zero wildcard mask bits to limit it to a single device (2^0=1).
    – Ron Maupin
    Nov 23, 2020 at 21:52
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 16, 2020 at 23:39

2 Answers 2

0

Remote Ip = 192.168.10.2 Wildecard Mask = 0.0.0.255 the server deny all hosts.

Yes, because the wildcard 0.0.0.255 matches all hosts from 192.168.10.0 through 192.168.10.255. You need to use a wildcard of 0.0.0.0 (no wildcard bits = direct match).

Any wildcard bit you use tells the TCAM to ignore mismatches on that bit. Accordingly a single wildcard bit matches two addresses:

  • 192.168.10.2/0.0.0.128 matches 192.168.10.2 and 192.168.10.130
  • 192.168.10.2/0.0.0.32 matches 192.168.10.2 and 192.168.10.34
  • 192.168.10.2/0.0.0.1 matches 192.168.10.2 and 192.168.10.3

and so on.

Two wildcard bits match four addresses, three bits match eight addresses, etc.

You can only specify ranges if they match binary patterns.

3
  • Sorry for stupid question, I'm still learning, but let's take the second example, if i set 192.168.10.2/0.0.0.32 will the firewall ignore all IPs from 192.168.10.2 to 192.168.10.34 or only these 2 specific IPs? Logically what I'm thinking is that this is a range, but I want to be sure.
    – sticsk
    Dec 24, 2020 at 0:32
  • 1
    With a wildcard of 32 = binary 0010 0000, the pattern 0000 0010 matches 0000 0010 and 0010 0010 = .2 and .34 - not a range. Note the difference to the CIDR notation, e.g. /24 = 0.0.0.255 matching w.x.y.0 through x.x.y.255.
    – Zac67
    Dec 24, 2020 at 8:02
  • Very well, thank you very much for answering.
    – sticsk
    Dec 24, 2020 at 12:10
0

Configuring a firewall feature set on a server depends on the type of server, e.g. Windows or Unix-based system.

For Linux, Opensource.com's Linux firewalls: What you need to know about iptables and firewalld article says:

On the one hand, iptables is a tool for managing firewall rules on a Linux machine.

On the other hand, firewalld is also a tool for managing firewall rules on a Linux machine.

You got a problem with that? And would it spoil your day if I told you that there was another tool out there, called nftables?

Assuming the iptables approach, see iptables drop all incoming ICMP requests except from one IP which states:

iptables -A INPUT -s x.x.x.x -p ICMP --icmp-type 8 -j ACCEPT 
iptables -A INPUT -p ICMP --icmp-type 8 -j DROP

On windows servers, Microsoft's Create an Inbound ICMP Rule article states:

On the Scope page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click Next.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.